Read our latest case study on how a Gen-AI-enabled workflow can transform a generic repair activity into a root-cause and product improvement intelligence
What is the Cyber Resilience Act—and what does it mean for a product company?
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, turns product cybersecurity from a customer expectation into a legal condition for selling connected products in the EU.
ELECTRONIC SYSTEM DESIGNAIPCB MANUFACTURINGSCHEMATIC ENTRYLIBRARY MANAGEMENTPCB DESIGNCUSTOMER SUCCESS
Atanu
10/27/20262 min read
What is the Cyber Resilience Act—and what does it mean for a product company?
The EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, turns product cybersecurity from a customer expectation into a legal condition for selling connected products in the EU. It applies to products with digital elements—hardware, software, firmware, and separately supplied components—with direct or indirect network connectivity.
For an Irish product company, the CRA has two immediate implications. First, vulnerability and incident reporting duties have applied since 11 September 2026. Second, full essential requirements, conformity assessment, and CE marking apply from 11 December 2027.
What counts as a product with digital elements?
A product is likely in scope if it has a chip, executes code, and communicates through Wi-Fi, Bluetooth, Ethernet, cellular, USB, or another connection. The CRA follows the product rather than the company: an Irish manufacturer, an importer, a distributor, or a non-EU company selling into the EU can all have obligations.
The scope also includes remote data-processing solutions that a product needs to function. That means a connected device plus its essential cloud service may need to be assessed together, rather than treating the cloud as automatically outside product regulation.
What a product company must do
The CRA requires manufacturers to build security into the product lifecycle. In practical terms, that means:
Identify assets, attack surfaces, and plausible threats.
Apply security-by-design and secure-by-default configuration.
Protect confidentiality, integrity, and availability of product functions and data.
Manage vulnerabilities through monitoring, triage, remediation, and coordinated disclosure.
Maintain an SBOM covering the product’s software and dependencies.
Provide security updates, preferably automatically where appropriate.
Sign updates and protect the update mechanism.
State the support period at the point of sale.
Keep technical documentation and evidence of conformity.
These are not abstract policies. They require engineering decisions: secure boot, code signing, dependency management, logging, incident response, and a controlled release process.
The two deadlines
The reporting obligation is already in force. Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform, with an early warning within 24 hours of awareness. This applies to products already on the EU market, not only new launches.
From 11 December 2027, products must comply with Annex I essential requirements and undergo the applicable conformity-assessment route before being placed on the EU market. CE marking then signals that the manufacturer has met the applicable requirements.
Why it matters commercially
The biggest near-term risk for many SMBs is not a regulator’s fine; it is losing access to customers. Enterprise buyers, medical-device integrators, industrial OEMs, and public-sector purchasers increasingly require supplier security evidence. A missing SBOM, unclear vulnerability process, or unsupported legacy product can disqualify a supplier before the legal deadline arrives.
The CRA is demanding, but it is manageable if treated as a product-engineering programme rather than a paperwork exercise. Start with a product inventory, classify scope, map evidence gaps, and build the vulnerability and update processes that your customers will soon expect.
